index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("78c255a98003a101fa5ba3f49c50c6922b52ede601edac5db036ab72efc57629","0588f61dc7e4b24554cffe4ea56d043d8f6139d2569bc180d4a77cf75b68792f","441a3810b9e89bae12eea285a63f92e98181e9fb9efd6c57ef6d265435484964","cbae79f66f724e0fe1705d6b5db3cc8a4e89f6bdf4c37004aa1d45eeab26e84b","fd6515a71530b8329e2c0104d0866c5c6f87546d4b44cc17bbb03e64663b11fc","5d169e083faa73f2920c8593fb95f599dad93d34a6aa2b0f794be978e44c8206","7f29b69eb1af1cc6c1998bad980640bfe779525fd5bb775bc36a0ce3789a8bfc","02a59fe2c94151a08d75a692b550e66a8738eb47f0001234c600b562bf8c227d","7f84bf6a016ca15e654fb5ebc36fd7407cb32c69a0335a32bfc36cb91e36184d","afab2e77dc14831f1719e746042063a8ec107de0e9730249d5681d07f598e5ec","894138dfeee756e366c65a197b4dbef8816406bc32697fac6621601debe17d53","4611340fdade4e36f074f75294194b64dcf2ec0db00f3d958956b4b0d6586431","c96ae21b4cf2e28eec222cfe6ca903c4767a068630a73eca58424f9a975c6b7d","fa30be45c5c5a8f679b42ae85410f6099f66fe2b38eb7aa460bcc022babb41ca","e64bea4032cf2694e85ede1745811e7585d3580821a00ae1b9123bb3d2d442d6")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Endpoint Management Systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Endpoint Management Systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "acrobatrelay.com" OR destinationhostname CONTAINS "finconsult.cc" OR destinationhostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "acrobatrelay.com" OR sourcentdomain CONTAINS "finconsult.cc" OR sourcentdomain CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "acrobatrelay.com" OR sourcehostname CONTAINS "finconsult.cc" OR sourcehostname CONTAINS "realmetaldns.com")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "acrobatrelay.com" OR destinationntdomain CONTAINS "finconsult.cc" OR destinationntdomain CONTAINS "realmetaldns.com")
